In the ordinary course of business, we, our third-party service providers and our suppliers receive, store, transmit, and use data, including the personal information of customers, such as names, addresses, email addresses, credit information and other housing and energy use data, as well as the personal information of our employees. Any unauthorized disclosure of such personal information, whether through a breach of our systems or those of our third-party service providers or suppliers by an unauthorized party, including, but not limited to hackers, threat actors, sophisticated nation-states or nation-state-supported actors, or through the personnel theft, or misuse of information, or otherwise, could harm our business. In addition, we, our third party service providers and our suppliers may be subject to a variety of evolving threats, such as computer malware (including as a result of advanced persistent threat intrusions), ransomware, malicious code (such as viruses or worms), social engineering (including spear phishing and smishing attacks), telecommunications failures, natural disasters and extreme weather events, general hacking and other similar threats.
Cybersecurity incidents have become more prevalent and could occur on our systems and those of our third parties in the future. Our team members who work remotely pose increased risks to our information technology systems and data, because many of them utilize less secure network connections outside our premises.
Inadvertent disclosure of confidential data or unauthorized access by a third party could result in future claims or litigation arising from damages suffered by those affected, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, indemnification obligations, reputational harm, interruptions in our operations, financial loss, and other similar harms. In addition, we could incur significant costs in complying with the multitude of federal, state, and local laws, and applicable independent security control frameworks, regarding the unauthorized disclosure of personal information. Although we have not experienced a material information security breach in the past and have developed systems and processes to prevent or detect security breaches and protect the confidential information we receive, store, transmit, and use, we cannot assure that such measures will provide adequate security. Finally, any perceived or actual unauthorized disclosure of such information, unauthorized intrusion, or other cyberthreat could harm our reputation, substantially impair our ability to attract and retain customers, interrupt our operations, and have an adverse impact on our business.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. While we currently maintain cybersecurity insurance, such insurance may not be sufficient to cover us against claims, and we cannot be certain that cybersecurity insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.